The 'uploader-frontend' npm package version 9.9.11 includes a malicious install script that executes 'node index.js' during installation. This script loads internal modules and collects sensitive environment information such as the OS username (via os.userInfo().username), hostname (os.hostname()), and current working directory basename. It encodes this data into a DNS subdomain and performs a DNS resolve4 lookup against a hardcoded attacker domain 'oob.sl4x0.xyz', serving as an out-of-band beacon to exfiltrate the installer's identity. The code obfuscates the API calls and domain name by reconstructing strings from character codes at runtime. The package's author email and homepage point to attacker-controlled infrastructure, confirming malicious intent. No legitimate functionality is implemented despite the package's advertised purpose.

This malicious package compromises user privacy by exfiltrating sensitive environment information during installation, including OS username, hostname, and working directory name. While it does not appear to execute further payloads or system compromise, the leakage of this data can aid attackers in profiling victims or preparing targeted attacks. There is no evidence of active exploitation in the wild at this time.

No official patch or remediation is currently documented. Users should avoid installing version 9.9.11 of 'uploader-frontend' from npm. If already installed, remove the package and investigate any related systems for signs of data leakage. Monitor for updates or advisories from the package maintainers or npm security teams regarding this malicious package. Since this is a malicious package published to npm, consider using package integrity verification and trusted sources for dependencies.